From nobody Mon Sep 28 11:40:00 2026 Received: from mail-qv1-f51.google.com (mail-qv1-f51.google.com [209.85.219.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F17C37E5CF for ; Sat, 22 Aug 2026 07:52:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787385173; cv=none; b=f0B2qkmHIVFsSmqa6fgoUg0gNv04eVUCZY4/V2wP8wNFLLWLgHBvCyAq3r9k8/MWnE8boqjmzXZvWgBSSCk79/q07cxgnuJ50dER517X/omPvnWWtv/29kIysM5XC74401IrcqbFN8sc9SQ7h9kEEkSThMBKjGf9+wvStnl5B1k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787385173; c=relaxed/simple; bh=XgYVXwC6Qbtpg1jrCFNAUGWaPBGKnylLGiRS03qHRuI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Dx/rWuAELrLLc0QvCvL+AVLkiXOUsNz7mOTmZrdxfQXAQhCmcAdrVmt93N5HSfu9OwZHV67B2eQvGArK+m9WGkgYTxLSn9d4dfo8x03ccG0Bun7JwHuuWVSzdBUi/1aS3zfPTorFhXtmie2KanzotnXhlMYLrs5JrCsdZJbjc2s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iPx0Q1YU; arc=none smtp.client-ip=209.85.219.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iPx0Q1YU" Received: by mail-qv1-f51.google.com with SMTP id 6a1803df08f44-902e4af2d9dso18352526d6.0 for ; Sat, 22 Aug 2026 00:52:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787385169; x=1787989969; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=bGwg1zuDZKdGriy8KZp6u78c5XQmmAncdFIw6xyowec=; b=iPx0Q1YUwDzRvZpfNK5FadAiUeQUPrLA94vZtVeRO1wVwdH1R4SD7yPt2yxafyBFfV wW3CaJUqW6j2ONyPpEoqLMEDbPfd3AXYcCFbkb43sER7WfdMnUy5POzAsV4dV8KOxiaL pJ2WsTiNP332xNE0mNTqzjR5o4Myl1sCvJa/Uy3dz9aiEj2xPyitFwj5PIru/SKC0Is/ wWQNkoSHxCgVrowsrsbpQBBWYclSA9O1h76RFNy3dsxv0sZxf/MQmkyq6Ph81k68DmrQ lVuao/ofdWgpeDUTyLhP7LANkchbMWfuDNQN8Be2fVd/bw10MlOn8mCEWn4n5Kmq9CQY sNrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787385169; x=1787989969; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bGwg1zuDZKdGriy8KZp6u78c5XQmmAncdFIw6xyowec=; b=mexrlmcCb5YiouSZjUDX2535FGMsekWqSGUsOhh0lZERx8KCFpMCfPTCVyXQEi3fPJ PlwXA5tInKF0ebhpUjCzz7L85wVl99rTD6s8rdKQ+c7Nh1BHqJJw1n77wKKhqLiJQ3PN cafQjMXvuzFEbzaM0aoHKf29mnOZpFdnTC12fW+hVS75UdNpb5POLFPGb7ZqgZ8Joy9p oYE8sr1KBA//nwQ2TmSbCmi728n3tAi0doy0Az0s2RFfAvatFEag5m0bIYmW7e8745tD /1zrRvQF8T3y9qrj9rxGUxpOnVAd2eGONLOGFz+mGeIYNjOg/4B3J2qSBldc4hh91jGv QyAA== X-Forwarded-Encrypted: i=1; AHgh+Rr451I6EtqlubIh/+2vwceuQ2Gy8GbHi8c4lmwL/4dj+0HUP48tA2G2Y+djqiun1RxUX5CCPuzkorKF6Qw=@vger.kernel.org X-Gm-Message-State: AFuF++kiKnEY/S927i8vpquYOR65UWqW4aBI9U+GBo52YkAODwkNCvVw HxcFy3CuoUpjNcy4KT5nqLhkIvJO/7ZVMqAhGwbomMysI0eXx4cg4/Jc X-Gm-Gg: AR+sD10AbDVDk9pGcQBUnLAbs+2NXLijjaNk7JuEf+CYKGC0X6KMp0PQ0ypcwoDtNmc IUCupA/8dD80VycNOV7zFwg2jfgB89P/WMNMq6VaXhzHAJKOQPyuzpZRnjMqLXuWsd88J8yOKJe X6AFGeOHY0OoxVL4neGxmvAVu+1Gup6gMOzo6D/Ha1At7TYq8IMbkgAXOZbWtitALEmjO+i1e3U N6sR/FT7sCa9M7vlzjLeh4y9AfF0DG5MLN8XD/lI0QEXnBd5r3mWByfGKuSoEqr86cDE48ODSWN HoPaodVYD9ZgnOHIm1tj0a1UC4RL4TMJw03vimW37xozs2GLnGrzanSa0RUpZmIqiiOPB0oX1Ub CMzPmrkb4YJNxoV1LrocD8ISse1atKlV5cK0cgUm1lvlibP/SCnuthJxlhVsyDHG28/0BFKs9Ub Y3S1InGJDY2gjgX0I3GvHTRVDGVkgnWuw7/a5dzERcmas1Q02iwZ199rEm7Dri+2IkbGMx2n9UG zFGPzFX3br9w9oIa+3YJ8kowVKqPKAB8vt2yx/h+Krjq2i/XvtKK/4= X-Received: by 2002:a05:6214:2d4a:b0:8f1:74b0:a4ec with SMTP id 6a1803df08f44-90c811e5bdcmr112300816d6.4.1787385169528; Sat, 22 Aug 2026 00:52:49 -0700 (PDT) Received: from KernDev (pool-72-83-148-136.washdc.fios.verizon.net. [72.83.148.136]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90c93a5e82asm8436346d6.40.2026.08.22.00.52.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Aug 2026 00:52:49 -0700 (PDT) From: Alexander Bendezu To: Greg Kroah-Hartman Cc: Andrzej Pietrasiewicz , Felipe Balbi , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Alexander Bendezu , syzbot+3a0d6aa450317f25e501@syzkaller.appspotmail.com Subject: [PATCH] usb: gadget: f_phonet: fix out-of-bounds read in ifname_show Date: Sat, 22 Aug 2026 07:52:30 +0000 Message-ID: <20260822075230.70609-1-alexanderbendezu10@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The f_phonet_ifname_show() function incorrectly used gether_get_ifname(), which casts the net_device private data to 'struct eth_dev'. Since the Phonet gadget only allocates a small 'struct phonet_port' for its private data, this resulted in a KASAN slab-out-of-bounds read when accessing dev->ifname_set. Fix this by safely reading the network device name directly using netdev_name() and dropping the u_ether.h include, completely avoiding the invalid struct cast. Fixes: 0736390bea65 ("usb-gadget/f_phonet: use per-attribute show and store= methods") Reported-by: syzbot+3a0d6aa450317f25e501@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D3a0d6aa450317f25e501 Signed-off-by: Alexander Bendezu --- drivers/usb/gadget/function/f_phonet.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/fu= nction/f_phonet.c index b1ee9a7c2e94..a17e74bcc07c 100644 --- a/drivers/usb/gadget/function/f_phonet.c +++ b/drivers/usb/gadget/function/f_phonet.c @@ -13,6 +13,7 @@ #include #include =20 +#include #include #include #include @@ -600,7 +601,13 @@ static const struct configfs_item_operations phonet_it= em_ops =3D { =20 static ssize_t f_phonet_ifname_show(struct config_item *item, char *page) { - return gether_get_ifname(to_f_phonet_opts(item)->net, page, PAGE_SIZE); + struct net_device *net =3D to_f_phonet_opts(item)->net; + int ret; + + rtnl_lock(); + ret =3D scnprintf(page, PAGE_SIZE, "%s\n", netdev_name(net)); + rtnl_unlock(); + return ret; } =20 CONFIGFS_ATTR_RO(f_phonet_, ifname); --=20 2.53.0